Prevention vs Response: How to Evaluate a Program

The prevention vs response decision is the first real choice an organization makes about active shooter risk, and most organizations make it without realizing a choice was on the table. This guide is written for the people who sign the contract. It sets out what the two purchases actually buy, why response-only programs struggle under procurement scrutiny, and the seven questions to put to any provider before you commit.

What Your Organization Is Actually Choosing Between

Most organizations think they are choosing between training vendors. They are not. They are choosing where in the timeline they intend to spend their money and their attention.

Response programs buy competence in the last several minutes. Prevention programs buy influence over whether those minutes ever occur. Both are legitimate. Only one of them is a strategy, and an organization that has bought only the first has not finished the job.

On the response side, there is a separate question of which model an organization actually adopts, and why the field has never settled on one. The Active Shooter Response Standard covers that ground.

This page is written for the people who sign the contract. If you want the argument itself, our founder has written it in the first person: Active Shooter Prevention vs Response →

The Two Purchases, Side by Side

Set prevention vs response next to each other and the difference stops being philosophical. It becomes a line-by-line comparison of what activates when, who gets trained, what changes, and what a board is holding at the end.

Response-only program Prevention-first program
When it activates At the moment of attack Months earlier, at the first observable signal
Who it trains Everyone, to behave the same way Specific roles, to do specific things
What it changes Individual behavior under fire Policy, reporting routes, authority, physical habits
How success is measured Drill completion and attendance Gaps identified and closed; concerns raised and resolved
What it costs to sustain Repeated annually, forever Front-loaded, then maintained
What a board sees afterward A compliance record A documented reduction in specific, named exposures

Why Response-Only Fails Procurement Scrutiny

Ask a response-only program a simple question: what would have had to happen for this incident not to occur? It has no answer, because it was never designed to have one. Its entire scope begins after that question stops being answerable.

That is not a criticism of response training. We teach prevention, response and options , it is the R in the P.R.O. Model™. It is a criticism of buying response alone and recording it as though the risk has been addressed.

The Standard Question

You may be familiar with Run, Hide, Fight, Avoid, Deny, Defend, ALICE, CRASE, A.L.I.V.E. and others. Response already has one. ALERRT has been the FBI designated national standard for active shooter response training since 2013, and Run, Hide, Fight is the accepted civilian guidance beside it. We honor both, and we teach response ourselves. What none of them is, and none was ever built to be, is a prevention model, because every one of them begins after the attack has already started. That is the gap.

The P.R.O. Model™ is a national standard selected by the U.S. Department of Justice and in use at some installations and commands across the Department of Defense. For an organization that has to defend its choice to a board, an insurer or a community, that provenance is the difference between a preference and a standard.

What Duty of Care Looks Like in Practice

  • A written route for concerns. Somebody is always worried before an incident. The question is whether their concern had somewhere to go and someone obliged to act on it.
  • Named authority. Staff who are unsure whether they are permitted to challenge a stranger will not challenge a stranger, and the leader who carries that authority learns to use it in an active shooter tabletop simulation.
  • Physical habits, documented. The propped door, the unlocked side entrance, the badge nobody checks after 4pm. These are free to fix and rarely written down.
  • Evidence you acted. Prevention produces a record of specific exposures found and closed. Response training produces an attendance sheet.

How To Compare Vendors Honestly

Ask every provider the same seven questions, in the same order, and write down the answers. A strong program answers all seven without hedging. A response-only program will stall on the first one, and that is the point of asking it first.

  1. What would have had to happen for this incident not to occur? This is the whole test. A prevention program has an answer because it was designed around one. A response-only program cannot answer it, because its scope begins after that question stops being answerable.
  2. Who owns a concern once it is reported? Somebody is nearly always worried before an incident. Ask for the named role, the route, and the obligation to act. “We encourage reporting” is not an answer. A named person with authority is.
  3. What standard are you working to, and who selected it? Response has a standard. ALERRT has been the FBI designated national standard for response training since 2013, and Run, Hide, Fight is the accepted civilian guidance beside it. Prevention is where no standard existed. Ask which prevention standard you are working to, and who selected it. The P.R.O. Model™ is “A” national standard selected by the U.S. Department of Justice and in use at some installations and commands across the Department of Defense. That provenance is the difference between a preference and a standard when you are defending the choice later.
  4. What do you measure, and what does failure look like in your data? Attendance and drill completion measure delivery, not risk. Ask what number moves when the program works. Gaps identified and closed is a real measure. Concerns raised and resolved is a real measure. A signed roster is not.
  5. What happens in month seven? Most programs are strong on announcement week and silent afterward. Ask what exists in the seventh month, when the training is old, the staff has turned over, and nobody is thinking about it.
  6. What does this cost to sustain, not to start? Response training repeats annually, forever, because competence decays. Prevention work is front-loaded and then maintained. Ask for the five-year number, not the first invoice.
  7. What will my board see afterward? A compliance record proves you bought something. A documented reduction in specific, named exposures proves you changed something. Ask which one you will be holding.

One caution on how to read the answers. A provider who dismisses response training is selling as hard as one who dismisses prevention. Response is legitimate and necessary work, and it is the R in the P.R.O. Model™. The error is not buying response. The error is buying response alone and recording it as though the risk has been addressed.

Four questions that separate prevention programs from response programs wearing the word:

  1. Does the engagement begin with an assessment of our location, or with your curriculum?
  2. What do we receive that is specific to us and could not be sent to any other client?
  3. Which findings will cost us nothing to fix, and are you willing to tell us that before we buy?
  4. Who is accountable for the recommendations after you leave?

What a Complete Program Leaves Behind

The clearest way to evaluate a proposal is to ask what physically exists at the end of it. Training that leaves nothing behind but a memory and a roster has to be bought again every year to stay true.

A complete engagement produces artifacts you can hand to someone else. A written reporting route with a named owner. An assessment that lists specific exposures rather than general concerns, and shows which ones were closed. A documented escalation pathway that stays in force after the training day. Policy language your counsel can point to. Physical habits recorded as findings, including the propped door and the badge nobody checks, so the next person can verify them without repeating the whole assessment.

That documentation is also what an insurer, a regulator or a plaintiff’s attorney will ask to see. Duty of care is demonstrated with records, not intentions, and the organization that can produce them is in a materially different position from the one that can only produce an attendance sheet.

Where To Start

Understanding how these events unfold is what makes prevention possible. → The P.R.O. Model™